{"id":284,"date":"2010-03-24T15:24:29","date_gmt":"2010-03-24T20:24:29","guid":{"rendered":"http:\/\/zitstif.no-ip.org\/?p=284"},"modified":"2010-03-24T15:30:27","modified_gmt":"2010-03-24T20:30:27","slug":"netgear-rp614v4-exploit","status":"publish","type":"post","link":"http:\/\/zitstif.no-ip.org\/?p=284","title":{"rendered":"Netgear RP614v4 exploit"},"content":{"rendered":"

\"rp614v4\"<\/p>\n

Website\/Company:<\/strong> http:\/\/zitstif.no-ip.org
\nE-mail:<\/strong> zitstif[at]gmail.com<\/strong><\/p>\n

Name:<\/strong> Kyle Young
\n
\nDevice:<\/strong> Netgear RP614v4
\nFirmware version:<\/strong> v1.1.2_09.01
\nFirmware release date:<\/strong> November 2009
\nHTTP service:<\/strong> Boa HTTPd 0.93.15
\nExploit release date:<\/strong> Wednesday March 24, 2010<\/p>\n

Default router credentials:<\/strong>
\nusername: admin
\npassword: password<\/p>\n

Scope:<\/strong> Local\/Remote<\/p>\n

Vulnerability:<\/strong><\/p>\n

The Netgear RP614v4 is susceptible to an end user making a request for the netgear.cfg file which is located at:<\/p>\n

http:\/\/[RouterIP]\/vgn\/jsp\/netgear.cfg<\/p>\n

This file, is a plain text ASCII file that contains the router’s password at line 216, which looks similar to this:<\/p>\n

http_passwd=myvulnerablepassword<\/p>\n

You don’t have to authenticate to obtain this file at all.<\/strong><\/p>\n

The qualm with this exploit is that, it works in the LAN that the router is on, or even remotely over a WAN, that is if the remote administration
\noption is enabled and the default port for this is 8080.<\/p>\n

PoC:<\/strong> http:\/\/zitstif.no-ip.org\/rp614v4\/rp614v4exploit.txt<\/a><\/p>\n

Additional notes:<\/strong><\/p>\n

After discovering this vulnerability, I’ve noticed with other routers that have http based administration, is that you can make requests for config files without authenticating. However, this does not always work and at times the config file is obfuscated.<\/p>\n

From my experience, most of the config files for routers are in a binary format and can be viewed with a program like ‘bvi<\/strong>‘. <\/strong>At times, you can view credentials to the device and also PPPoE credentials.<\/p>\n

I’m reporting this vulnerability to securityfocus.com, due to the lack of support on Netgear’s end.<\/p>\n","protected":false},"excerpt":{"rendered":"

Website\/Company: http:\/\/zitstif.no-ip.org E-mail: zitstif[at]gmail.com Name: Kyle Young Device: Netgear RP614v4 Firmware version: v1.1.2_09.01 Firmware release date: November 2009 HTTP service: Boa HTTPd 0.93.15 Exploit release date: Wednesday March 24, 2010 Default router credentials: username: admin password: password Scope: Local\/Remote Vulnerability: The Netgear RP614v4 is susceptible to an end user making a request for the netgear.cfg … Continue reading Netgear RP614v4 exploit<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,106,3],"tags":[920,110,111,108,112,109,107],"class_list":["post-284","post","type-post","status-publish","format-standard","hentry","category-code","category-exploits","category-posts","tag-exploits","tag-netgear","tag-netgear-rp614v4-exploit","tag-router-exploit","tag-rp614v4","tag-rp614v4-exploit","tag-securityfocus"],"_links":{"self":[{"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/posts\/284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=284"}],"version-history":[{"count":4,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/posts\/284\/revisions"}],"predecessor-version":[{"id":287,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=\/wp\/v2\/posts\/284\/revisions\/287"}],"wp:attachment":[{"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=284"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/zitstif.no-ip.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}